Summary
This chapter introduced you to the codec layer or module of Snort 3. We saw the role of codecs, and also discussed the encapsulation and decapsulation processes that happen in every network stack and also in IDS/IPS. We used an example packet and discussed how the relevant codecs decoded the packet data in Snort 3. We looked at the layer 2 and layer 3 codec functionality in Snort 3. Finally, we looked at how the code is laid out and structured within Snort 3 code. In the next chapter, we will look into the TCP state tracking and inspectors.
